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Description 

Control ^ ^n^^ f n-r ar'^ j ^rp^ ^ -j onm^p-^nf prot n ct-jrin means in^ 

m otor vehicle and method for monitoring ^>^f> p-ro p^ -r f ^^nr■^ JLr>n^ nq 
5 of a control un it preferably of this type 

The invention relates to a control unit for activating an 
occupant protection means in a motor vehicle and to a method 
for monitoring the proper functioning of a control unit 

10 preferably of this type. To this end, the control unit 

comprises a first arithmetic unit, a second arithmetic unit 
and an activating unit which are respectively clocked 
asynchronously relative to one another. The control unit also 
comprises a first and a second logical AND gate. The first and 

15 the second arithmetic unit comprise respectively a pulse count 
comparator unit and a resetter. 

The clock signal of the arithmetic unit respectively assigned 
thereto, as well as the clock signal of the activating unit, 
20 are fed to each logical AND gate on the input side. The signal 
output of each logical AND gate is fed to the input of the 
pulse count comparator unit of each arithmetic unit and the 
output of the pulse count comparator unit to the input of the 
respectively relevant resetter of an arithmetic unit - 

25 

The resetter of each arithmetic unit is connected to the reset 
input of the respective other arithmetic unit so that the 
relevant resetter resets the respective other arithmetic unit 
when the relevant pulse count comparator unit detects an 
30 inadmissible number of pulses per unit of time in the output 
signal of the AND gate respectively connected thereto. 



The prior art monitors functional processes in arithmetic 
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units with the aid of circuits and, where faults are detected 
in the functional processes, resets the faulty arithmetic 
units. In the publications DE 100 56 408 CI, DE 100 30 991 Al, 
DE 100 49 440 Al and DE 40 39 355 Al a so-called watchdog 
5 circuit is used for this purpose, said watchdog circuit 

evaluating the pulses emitted by the arithmetic unit in terms 
of their pulse length, interval length or the number of pulses 
per unit of time. 

10 In many control systems today, a second arithmetic unit is 
provided in addition to a first arithmetic unit. As a fail- 
safe arithmetic unit, the second arithmetic unit serves here 
principally to monitor the proper functioning of the first 
arithmetic unit and, in the event of the failure thereof, 

15 possibly to take over at least partially the arithmetic and 
control functions of the first arithmetic unit. 

The use of such fail-safe arithmetic units is especially 
important in connection with a first main arithmetic unit in 

20 control systems whose failure would entail at least the risk 

of injury to persons. Such a safety-relevant control system is 
for example the control unit for controlling an occupant 
protection means in a motor vehicle. There, the main 
arithmetic unit calculates the start time for activating the 

25 appropriate occupant protection means which, in the event a 
collision accident, offers a vehicle occupant the best 
possible protection against injuries- After calculating the 
best start time, the main arithmetic unit releases activation 
of the appropriate occupant protection means, for example of a 

3 0 driver airbag. 

Even in the event of just a partial failure of the computing 
capacity of the main arithmetic unit, activation of the 
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appropriate occupant protection means at the correct time by 
the control unit can no longer be guaranteed. For this reason, 
the decision-making functionality of the first arithmetic unit 
must be taken over by the second arithmetic unit, the fail- 
5 safe arithmetic unit. To this end, the fail-safe arithmetic 
unit must first detect a possible malfunction of the first 
arithmetic unit, in order in a second step to reset or even 
fully disconnect the first arithmetic unit and, where 
applicable, take over at least partially the functions of the 
10 first arithmetic unit . 

Such a two-computer system in a safety-relevant application in 
a motor vehicle is described, for example, in the German 
unexamined patent application DE 37 00 986 Al . The processors 

15 shown there monitor one another on an equal footing. To this 
end, each arithmetic unit outputs a watchdog signal 33, 37, 
which is checked in the respective other arithmetic unit by 
means of a watchdog detection 14, 22. If each arithmetic unit 
receives from the respective other arithmetic unit a defective 

20 watchdog signal 33, 35, then the respective arithmetic unit 
functioning properly outputs a reset signal 40, 3 6 to the 
faulty other arithmetic unit. 

Similar control systems, each with two arithmetic units, in 
25 safety critical applications in motor vehicles, are also known 
from printed publications DE 101 51 012 Al and DE 40 04 709 
C2, the reciprocal monitoring of the two arithmetic units also 
being carried out here with the aid of one watchdog detection 
in each arithmetic unit - 

30 

The reciprocal monitoring of the correct functioning of 
arithmetic units by such a watchdog circuit is, however, often 
only very slow. Particularly in the case of occupant 
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protection systems, however, it is very important to detect a 
malfunction of an arithmetic unit within a control unit of an 
occupant protection system very quickly and reliably in order 
to be able to initiate action immediately to limit possible 
5 risks to a vehicle occupant. 

The object of the present invention is therefore to create the 
necessary technical preconditions in order to establish very 
rapid detection of the malfunctioning of at least one 
10 arithmetic unit within a control unit of an occupant 
protection means for a motor vehicle. 

The object is achieved in a control unit according to Claim 1. 

15 The control unit according to the invention has, in addition 
to the main arithmetic unit, the first arithmetic unit, a 
fail-safe arithmetic unit, the second arithmetic unit, as well 
as an activating unit for activating the occupant protection 
means, for example an airbag. The first arithmetic unit, the 

20 second arithmetic unit and the activating unit are 

respectively clocked asynchronously relative to one another by 
an internal or external clock-pulse generator. 

The first arithmetic unit comprises a first pulse count 
25 comparator unit and a first resetter, the second arithmetic 
unit a second pulse count comparator unit and a second 
resetter. Furthermore, the control unit has a first and a 
second logical AND gate respectively assigned to the first or 
second arithmetic unit. 

30 

Both the clock signal of the first arithmetic unit and the 
clock signal of the activating unit are fed to the input of 
the first logical AND gate, whereas its output is connected to 
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the input of the second pulse count comparator unit. The 
output of the second pulse count comparator unit is connected 
to an input of the second resetter whose output is in turn fed 
to the reset input of the first arithmetic unit. 

5 

The configuration of the first logical AND gate of the control 
unit is such that the second resetter resets the first 
arithmetic unit by outputting a reset signal if the second 
pulse count comparator unit detects an inadmissible number of 
10 pulses per unit of time in the output signal of the first AND 
gate . 

The configuration of the second logical AND gate follows, by 
analogy, the configuration of the first logical AND gate, 
15 whereby the first arithmetic unit is replaced by the second 
arithmetic unit and the first pulse count comparator unit is 
likewise replaced by the second, the first resetter by the 
second resetter and the reset input of the first arithmetic 
unit by the reset input of the second arithmetic unit. 

20 

Consequently, the configuration of the second AND gate is such 
that the first resetter resets the second arithmetic unit by 
outputting a reset signal if the first pulse count comparator 
unit detects an inadmissible number of pulses per unit of time 
25 in the output signal of the second AND gate- 

A pulse count comparator unit of an arithmetic unit of the 
control unit according to the invention is deemed in the 
context of the invention described here to be a functional 
30 unit which, for example, counts a number of high levels per 
unit of time in a pulse sequence and compares this with a 
previously stipulated comparative value. Depending on this 
comparison, the pulse count comparator unit can output 
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different control signals. 

Of course, a pulse count comparator unit could alternatively 
also count a number of low levels or a number of changes of 
5 level per unit of time in a pulse sequence . 

In an advantageous development, the control unit has a first 
and a second logical OR gate, the second OR gate being 
connected on the input side to the output of the second 

10 resetter and on the output side to the reset input of the 

first arithmetic unit and the first OR gate being connected 
correspondingly on the input side to the first resetter and on 
the output side to the reset input of the second arithmetic 
unit. This offers the advantage that further reset signals of 

15 other circuit elements of the control unit can be fed to a 
respective other input of the logical OR gates so that an 
arithmetic unit can be reset not only by the decision of the 
respective other arithmetic unit but also by a further 
decision of a further functional unit of the control unit. 

20 

In a further advantageous embodiment, the first resetter of 
the first arithmetic unit or the second resetter of the second 
arithmetic unit is connected to a reset input of the 
activating unit. In this way, the first resetter or the second 

25 resetter can, where a malfunction of the second or first 

arithmetic unit is identified, reset not only the respective 
other arithmetic unit but also the activating unit. This 
offers an additional safeguard with regard to a correct 
functioning of the occupant protection system since, in the 

3 0 event of a malfunction of at least one of the two arithmetic 
units, the activating unit will also safely be disabled. A 
possibly dangerous activation of the occupant protection means 
will safely be prevented by this means. 
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Consequently, the control unit possesses a particularly high 
level of safety above all when the two resetters of the 
arithmetic unit are connected to a reset input of the 
5 activating unit so that both arithmetic units can, where 

applicable, reset the activating unit. It is also advantageous 
here if the control unit has a third logical OR gate which on 
the input side receives the signals of the resetters of both 
arithmetic units and on the output side is connected to the 
10 reset input of the activating unit- 

In a further advantageous embodiment of the invention, the 
control unit has a third AND gate to which on the input side 
the clock signals of the first and second arithmetic unit are 

15 fed and whose signal output is fed to both the first and the 
second pulse count comparator unit of the first or second 
arithmetic unit. If the first or the second pulse count 
comparator unit identifies a defective output signal of the 
third AND gate, then it reports the fault to the resetter 

20 respectively assigned to it, which resetter resets the 

respective other arithmetic unit and, where applicable, also 
the activating unit. 

It is also advantageous if the control unit has a so-called 
25 first watchdog circuit- For this purpose, a first watchdog 

input of the activating unit is connected to a watchdog output 
of the first arithmetic unit and an arithmetic unit resetting 
output of the activating unit is connected directly or 
indirectly to the first arithmetic unit. If the activating 
30 unit identifies a fault in the watchdog signal of the watchdog 
output of the first arithmetic unit, then the activating unit 
outputs an arithmetic unit resetting signal directly or 
indirectly to the first arithmetic unit. Such a redundant 
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fail-safe circuit in the form of a first watchdog circuit 
additionally improves the safe disabling of a first arithmetic 
unit operating defectively within the control unit of the 
occupant protection system , 

5 

An analogous second watchdog circuit for the resetting of a 
defective second arithmetic unit by the activating unit 
provides additional safety, particularly where the second 
arithmetic unit contributes equally to the functioning of the 
10 safety system. 

A method suitable for achieving the object is specified in the 
independent Claim 7 . 

15 The method according to the invention serves to monitor the 
proper functioning of a control unit according to the 
invention for activating an occupant protection means in a 
motor vehicle. The sequence of such an inventive method has 
already been described sufficiently with regard to the 

20 features of an inventive device, the functional relationship 
of which features has been explained hereinabove. In order to 
avoid repetition at this point, only those features of the 
inventive method which go beyond the scope of what has already 
been outlined will be described here. 

25 

For example, the manner in which the clock signals of the two 
arithmetic units and of the activating unit are combined to 
form signals linked logically to one another in different ways 
is immaterial to a method according to the invention. In the 
30 inventive device described above, such a logical connecting 
function is achieved by means of logical AND gates which - 
like the OR gates also disclosed - can be fashioned both as 
electrical components and as program sequences within a 
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microprocessor. Rather, it is crucial to a method according to 
the invention that a logical operation of the mentioned clock 
signals be carried out in such a way that a pulse sequence is 
generated which, by counting the individual pulses and 
5 comparing the determined value with a setpoint value, can 

subsequently be evaluated to assess whether one of the clocked 
functional units of the control unit containing them is 
operating functionally correctly or not. 

10 To this end, the functional units identified as defective are 
advantageously reset at least once so that a functional unit 
operating defectively is given the opportunity through a 
restart to achieve a planned operational status. If such a 
proper operational status cannot be brought about after a 

15 single or multiple resetting of the functional unit, then at 
least the faulty part of the control device will be 
deactivated and, if possible, replaced by another functional 
unit of the control device. Where applicable, the entire 
control unit will be deactivated. 

20 

The partial or complete deactivation of the control device of 
the occupant protection system is then displayed accordingly 
to a vehicle occupant, for example through the flashing of a 
warning light, usually in the vehicle dashboard. 

25 

The invention will be described below with reference to 
several exemplary embodiments, in which: 

Figure 1 shows a control unit according to the invention 
3 0 comprising two AND gates (ANDl, AND2) , 

Figure 2 shows a control unit according to the invention 
comprising three AND gates (ANDl, AND2 , AND3) , 



PCT/DE2003/003737 / 2 002P1483 OWOUS 



Figure 3 shows a schematic runtime diagram of the clock 

signals (clkl, clk2, clk3) of the first and of the 
second arithmetic unit (Rl, R2) and of the activating 
5 unit (AE) and of the clock signals composed thereof 

(clkl3, clk23, clkl2) at the output of the first, 
second and third AND gate (ANDl, AND2 , AND3 ) , 

Figure 4 shows a schematic runtime diagram of the clock 
10 signals (clkl, clk2) of the first and of the second 

arithmetic unit (Rl, R2) arid of the associated output 
signal (clkl2) of the third AND gate (AND3) in the 
case of synchronization of the two arithmetic units 
(Rl, R2) and 

15 

Figure 5 shows a schematic decision matrix for resetting the 

arithmetic units (Rl, R2) or the activating unit (AE) 
of a control unit according to the invention , 

20 Figure 1 shows a control unit according to the invention, 

comprising a first and second arithmetic unit Rl, R2 and an 
activating unit AE as well as a first and a second AND gate 
ANDl, AND2 and a first, second and third OR gate ORl, 0R2 , 
OR3 . 

25 

The clock signal clkl of the first arithmetic unit Rl is fed 
to the first signal input of the first AND gate ANDl, The 
clock signal clk3 of the activating unit AE is fed to the 
second signal input of the first AND gate ANDl. A logical sum 
30 signal clkl3 of the two clock signals clkl, clk3 fed on the 
input side is present at the signal output of the first AND 
gate, which logical sum signal is fed to a pulse count 
comparator unit PZVE2 of the second arithmetic unit R2 . The 
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signal output of the second pulse count comparator unit PZVE2 
is connected to a second resetter RES2 within the second 
arithmetic unit R2 . The second resetter RES2 is connected on 
the output side to a signal input of the second OR gate OR2 . 
5 The signal output of the second OR gate OR2 is in turn 
connected to the first reset input RESETl of the first 
arithmetic unit Rl . 

The second AND gate AND2 is also configured similarly to the 
configuration of the first AND gate ANDl . The clock signal 
clk2 of the second arithmetic unit R2 is fed to the first 
signal input of the second AND gate AND2, likewise the clock 
signal clk3 of the activating unit AE is fed to its second 
signal input. The output signal clk23 of the second logical 
AND gate AND2 is a logical sum signal of the two clock signals 
clk2 and clk3 fed on the input side and is fed to the first 
pulse count comparator unit PZVEl of the first arithmetic unit 
Rl. The first pulse count comparator unit PZVEl directs an 
output signal to the first resetter RESl which is connected on 
the output side to the signal input of the first OR gate ORl - 
The signal output of the first OR gate ORl is fed to the reset 
input RESET2 of the second arithmetic unit R2 . 

A respective second signal output of the first resetter RESl 
25 or of the second resetter RES2 is connected respectively to a 
signal input of a third OR gate OR3 . The signal output of the 
third OR gate OR3 is connected to a reset input RESETAE of the 
activating unit AE. 

3 0 Furthermore, a first watchdog signal wdl is fed from a 

watchdog output WDl of the first arithmetic unit Rl to a first 
watchdog input AEl of the activating unit AE. Analogously, a 
second watchdog signal wd2 is also fed from a second watchdog 
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output WD2 of the second arithmetic unit R2 to a second 
watchdog input AE2 of the activating unit AE. 

Finally, an arithmetic unit resetting output SAE of the 
5 activating unit AE is connected to the respective second 

signal inputs of the first OR gate ORl and of the second OR 
gate OR2 . 

The circuit shown in Figure 1 functions as follows: 

10 

The first AND gate ANDl generates on the output side a 
modified clock signal clkl3 from the two clock signals fed on 
the input side, that of the first arithmetic unit clkl and of 
the clock signal of the activating unit clk3 . As shown in 

15 Figure 3, the output signal clkl3 of the first AND gate ANDl 
has a logical high level only when the clock signals clkl and 
clk3 fed on the input side simultaneously also have a logical 
high level. Since, in the embodiment shown in Figure 3, the 
clock signal clkl of the first arithmetic unit Rl with a clock 

20 frequency of, for example, 1 kHz has a substantially greater 
clock pulse period than the clock signal clk3 of the 
activating unit AE with a clock frequency of, for example, 50 
kHz, the modified clock signal clkl3 has a recurring pulse 
sequence with a period of the first clock signal clkl, with 

25 individual pulses within the pulse sequences having a 

periodicity of the clock signal clk3 of the activating unit 
AE. 

Depending on the shift of the clock pulse periods of the two 
3 0 clock signals clkl and clk3 relative to one another, the 

output signal clkl3 of the first AND gate ANDl has a fixed 
number of individual pulses per period length. In the example 
in Figure 3, the clock signal clkl3 has for example between 49 



PCT/DE2003/003737 / 2002P14830WOUS 



13 

and 50 high-level pulses per pulse -sequence period length. 

Where the two clock signals clkl and clk3 are synchronized, 
the number of individual pulses within a pulse sequence per 
5 unit of time would always be the same. A relevant case is 

shown, for example, in Figure 4 for the two signals clkl and 
clk2 with clock frequencies of, for example, 1 kHz and 2 kHz. 

The second pulse count comparator unit PZVE2 of the second 
10 arithmetic unit R2 counts the number of individual pulses in 
the output signal clkl3 of the first AND gate ANDl and 
compares this value with a comparative value which is stored 
in the second arithmetic unit R2 , for example in a RAM memory. 
If the determined number of pulses in the output signal clkl3 
15 of the first AND gate ANDl deviates from this stored value in 
an inadmissible manner, then the second pulse count comparator 
unit PZVE2 activates the second resetter RES2 which outputs a 
second reset signal sr2 via the second OR gate 0R2 to the 
reset input RESETl of the first arithmetic unit Rl . The first 
20 arithmetic unit Rl is reset electrically by this means. 

In the embodiment shown in Figure 1, the second resetter RES2 
can optionally simultaneously forward a further resetting 
signal sae2 via the third OR gate OR3 to the activating unit 
25 AE, as a result of which the activating unit AE is also reset 
to its initial electrical status. 

In the reset status, an occupant protection means connected to 
the activating unit AE can neither be controlled by the first 
30 arithmetic unit Rl nor activated by the activating unit AE. 

After the resetting of the first arithmetic unit Rl and of the 
activating unit AE, both run through a function ramp-up. 
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during which the full functionality of the two functional 
units Rl and AE within the control device of the occupant 
protection means is fully restored. Only when the function 
ramp-up of the two functional units Rl and AE has been 
5 completed successfully can the occupant protection means 
connected to the activating unit AE be reactivated if 
necessary - 

If, however, the second pulse count comparator unit PZVE2 of 
the second arithmetic unit R2 identifies in turn a malfunction 
either of the first arithmetic unit Rl or of the activating 
unit AE from the output signal clkl3 of the first AND gate 
ANDl, then the two functional units Rl and AE are once again 
reset or permanently deactivated. 

A permanent deactivation of the first arithmetic unit Rl or of 
the activating unit AE of the occupant protection means is 
usually displayed to the vehicle owner by means of a so-called 
airbag warning light in the vehicle dashboard. 

The way in which the configuration of the second AND gate AND2 
functions is completely analogous with the functioning of the 
configuration of the first AND gate ANDl: 

25 The second AND gate AND2 generates on the output side a 

modified clock signal clk23 from the two clock signals fed on 
the input side clk2 from the second arithmetic unit R2 and the 
clock signal clk3 from the activating unit AE. As in the case 
of the first AND gate ANDl, the output signal clk23 of the 

3 0 second AND gate AND2 has a logical high level only when the 
clock signals fed on the input side clk2 and clk3 
simultaneously also have a logical high level. Here, too, the 
period of the second clock signal clk2 is normally less than 
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the period of the clock signal clk3 of the activating unit AE. 
Therefore, pulse sequences also occur in the output signal of 
the second AND gate clk2 3 which are modulated with the slower 
period of the clock signal of the second arithmetic unit clk2 
5 and, depending on the period shift of the two merged clock 
signals clk2 and clk3, have, within a narrow range of 
tolerance, a fixed number of individual pulses per unit of 
time . 

The first pulse count comparator unit PZVEl of the first 
arithmetic unit Rl counts the number of individual pulses in 
the output signal clk23 of the second AND gate AND2 and 
compares the determined value with a further comparative value 
which has been stored in the first arithmetic unit Rl, for 
example in a RAM memory. If the determined number of pulses in 
the output signal clk23 of the second AND gate AND2 deviates 
from this further comparative value, then in this case the 
first pulse count comparator unit PZVEl activates the first 
resetter RESl which outputs a reset signal srl via the first 
OR gate ORl to the reset input RESET2 of the second arithmetic 
unit R2 . By this means, the second arithmetic unit R2 is reset 
electrically by the first arithmetic unit Rl . 

In the embodiment shown in Figure 1, the first resetter RESl 
25 can also simultaneously forward a resetting signal sael via 
the third OR gate OR3 to the activating unit AE, by means of 
which the activating unit AE is also reset to its initial 
electrical status . 

30 In the exemplary embodiment shown in Figure 1, the method 

described previously for the resetting of the first arithmetic 
unit Rl and of the activating unit AE by the second resetter 
RES2 and for the renewed function ramp-up of the first 
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arithmetic unit Rl and of the activating unit AE initiated as 
a result otherwise applies in a fully analogous manner to the 
resetting of the second arithmetic unit R2 and of the 
activating unit AE by the first resetter RESl and to a renewed 
5 function ramp-up of these two functional units initiated as a 
result . 

Correspondingly, a permanent deactivation of the first 
arithmetic unit Rl or of the activating unit AE of the 
10 occupant protection means is also displayed to the vehicle 
owner by a so-called airbag warning light in the vehicle 
dashboard. 

In order further to increase certainty in the detection of 
possible malfunctions of the control device of the occupant 
protection means, additional functional monitoring of the 
first arithmetic unit Rl by the activating unit AE is 
implemented in the shown control unit according to the 
invention with the aid of a so-called first watchdog circuit 
WDSl: 

The first arithmetic unit Rl outputs at periodic intervals a 
first watchdog signal wdl to the activating unit AE . If the 
expected watchdog signal wdl is not received by the watchdog 
signal input AEl, the activating unit AE outputs an arithmetic 
unit resetting signal sae from its signal output SAE to the 
second signal input both of the first OR unit ORl and of the 
second OR unit 0R2 , by means of which both the first 
arithmetic unit Rl is reset via the first reset input RESETl 
and the second arithmetic unit R2 is reset via the second 
reset input RESET2 . 

Alternatively, a circuit arrangement can also be used in which 
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the signal output SAE of the activating unit AE is not 
connected to the second signal input of the first OR unit ORl . 
Consequently, the activating unit AE then outputs the 
arithmetic unit resetting signal sae only to the second signal 
5 input of the second OR unit OR2 so that in the event of a 
fault in the first watchdog circuit WDSl only the first 
arithmetic unit Rl is reset via the first reset input RESETl . 

In any case, possible additional faults in the first 
10 arithmetic unit Rl, which can be seen from the output signal 

clkl3 of the first AND gate ANDl, can be detected by the first 
watchdog circuit WDSl. 

In a manner analogous to that in which monitoring is carried 
15 out by means of the first watchdog circuit WDSl in the case of 
the first arithmetic unit Rl, in Figure 1 the second 
arithmetic unit R2 is monitored from the activating unit AE by 
means of a second watchdog circuit WDS2 via a connection of 
the second watchdog output WD2 to a second watchdog input AE2 
20 of the activating unit AE and with the help of a periodic 
watchdog signal wd2 . By analogy with the first watchdog 
circuit WDSl, in the case of the second .watchdog circuit WDS2 
in Figure 1, the activating unit AE resets in the event of an 
admissible watchdog signal wd2 both the second arithmetic unit 
25 R2 and the first arithmetic unit Rl by means of the arithmetic 
unit resetting signal sae. 

Alternatively, however, a circuit arrangement is also feasible 
in which the signal output SAE of the activating unit AE is 
30 not, as shown in Figure 1, connected to both OR gates ORl and 
OR2 but only to the second signal input of the first OR unit 
ORl. Consequently, the activating unit AE then emits the 
arithmetic unit resetting signal sae only to the second signal 
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input of the first OR unit ORl, so that in the event of a 
fault in the second watchdog circuit WDS2 only the second 
arithmetic unit R2 is reset via the second reset input RESET2 . 

5 The second watchdog circuit WDS2 can in this way also detect 
faults in the second arithmetic unit R2 which cannot be seen 
from the output signal clk23 of the second AND gate AND2 , 

In the case of single or multiple resetting of at least one of 
10 the two arithmetic units Rl or R2 by at least one of the two 
watchdog circuits WDSl and WDS2 , a warning light in the 
vehicle interior is activated as an indicator to the vehicle 
owner of a possible malfunction of the control unit for the 
occupant protection system. 

15 

As in the example shown in Figure 1, the two watchdog circuits 
WDSl and WDS2 can be used simultaneously. It is, however, 
equally possible for just one of the two watchdog circuits 
WDSl or WDS2 to be provided within the control unit according 
20 to the invention, which watchdog circuit is, however, in each 
case configured such that it can reset at least one of the two 
arithmetic units Rl and R2 and optionally also the activating 
unit AE. 

25 Figure 2 shows the control unit according to the invention as 
shown in Figure 1 but supplemented by a third AND gate AND3 . 
The clock signals clkl and clk2 of the first arithmetic unit 
Rl and of the second arithmetic unit R2 are fed on the input 
side to the third AND gate AND3 . At the signal output of the 

30 third AND gate AND3 is a logical sum signal clk23 of the two 

clock signals clkl and clk2 of the two arithmetic units Rl and 
R2 which is fed to a respective second signal input of the 
first pulse count comparator unit PZVEl and of the second 
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pulse count comparator unit PZVE2 . The respective signal 
output of the first or second pulse count comparator unit 
PZVEl or PZVE2 is connected to the first resetter RESl or to 
the second resetter RES2 . 

5 

A first output signal srl of the first resetter RESl of the 
first arithmetic unit Rl is fed to an input of the first OR 
unit ORl . The signal output of the first OR unit ORl is 
connected to the second reset input RESET2 , as already 

10 explained further above. Analogously, a signal output sr2 of 
the second resetter RES2 of the second arithmetic unit R2 is 
connected to a signal input of the second OR gate OR2 . The 
signal output of the second OR gate OR2 is connected to the 
first reset input RESETl of the first arithmetic unit Rl, as 

15 also already described further above. 

The output signal of the third AND gate clkl2 is evaluated in 
quite a similar manner to the two output signals of the two 
other AND gates ANDl and AND2 : 

20 

The first pulse count comparator unit PZVEl counts the number 
of pulses received in the output signal clkl2 of the third AND 
gate AND3 and compares the number of pulses received per unit 
of time with a previously defined value which is stored for 

25 example in a RAM memory of the first arithmetic unit Rl • If 
this value deviates from the stored value by more than a 
previously defined admissible maximum, then the first pulse 
count comparator unit PZVEl activates the first resetter RESl 
which resets the second arithmetic unit Rl indirectly via the 

30 first OR gate ORl. 

The second pulse count comparator unit PZVE2 likewise 
determines the number of pulses received in the output signal 
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clkl2 of the third AND gate AND3 and releases, in the event of 
a number of individual pulses per unit of time being detected 
as being inadmissible, the activation of the second resetter 
RES2 which then resets the first arithmetic unit Rl indirectly 
5 via the second OR gate 0R2 . 

In the exemplary embodiment in Figure 2, a resetting of the 
activating unit AE can be initiated via the third OR gate OR3 
simultaneously with the resetting of the first arithmetic unit 
10 Rl or of the second arithmetic unit R2 . 

Through addition of the third AND gate AND3 , the arithmetic 
units Rl and R2 can consequently reset one another 
reciprocally if at least one of the clock signals of one of 

15 the two arithmetic units Rl or R2 is defective. In contrast to 
a resetting of at least one of the two arithmetic units Rl or 
R2 and optionally also of the activating unit AE on the basis 
of the signals clkl3 and clk23 of the first AND gate ANDl and 
of the second AND gate AND2 , a resetting of the arithmetic 

20 units Rl and R2 and preferably also of the activating unit AE 
can therefore be carried out by evaluating the output signal 
clkl2 of the third AND gate AND3 completely independently of 
the clock signal clk3 of the activating unit AE. 

25 Figure 5 shows in summary a possible decision matrix according 
to which the two arithmetic units Rl, R2 and the activating 
unit AE of the control unit according to the invention as per 
Figure 2 can be reset : 

30 A zero entered in the matrix signifies a proper functioning of 
the clock signals clkl, clk2, clk3 of the logical AND-combined 
clock signals clkl3, clkl2, clk23 and also a proper 
functioning of the first arithmetic unit Rl, of the second 
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arithmetic unit R2 and of the activating unit AE. An X entered 
in the decision matrix signifies by contrast a defective clock 
signal clkl, clk2, clk3 or a defectively composed clock signal 
clkl3, clkl2 and clk23, or a defective functioning of the 
5 first arithmetic unit Rl, of the second arithmetic unit R2 or 
of the activating unit AE . 

The arrows entered in the last three lines indicate with their 
points those arithmetic units Rl and R2 or the activating unit 
10 AE which is reset by the arithmetic unit Rl or R2 or by the 
activating unit AE at the starting point of the arrow. 

The columns of the decision matrix in Figure 5 should 
accordingly be read as follows: 

15 

In column 1, all the clock signals clkl, clk2, clk3 , clkl3, 
clkl2 and clk23 are functioning properly since the arithmetic 
units involved Rl, R2 and the activating unit AE are also 
operating properly. 

20 

A defective clock signal clk3 of the activating unit AE is 
entered in the second column. Consequently, the combined clock 
signals clkl3 and clk23 are also defective. The properly 
functioning first arithmetic unit Rl as well as the properly 
25 functioning second arithmetic unit R2 reset in this case the 
faulty activating unit AE. 

In the third column, the clock signal clk2 of the second 
arithmetic unit R2 is defective. Consequently, the clock 
30 signals clkl2 and clk23 derived therefrom are also defective . 
In this constellation, the properly functioning first 
arithmetic unit Rl would reset the faulty arithmetic unit R2 . 
While the activating unit AE is functioning perfectly in this 
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case, it could, based on the circuit arrangement shown in 
Figure 2, also be reset via the third AND gate by the first 
arithmetic unit Rl . 

5 In column 4, only the first arithmetic unit Rl is functioning 
properly and consequently resets the faulty second arithmetic 
unit R2 and the faulty activating unit AE. 

Analogously, the properly functioning second arithmetic unit 
10 R2 in column 6 resets the faulty first arithmetic unit Rl and 
the faulty activating unit AE. 

In column 5, in addition to the activating unit AE, the second 
arithmetic unit R2 is also functioning as provided- Since the 

15 detection of a defectively functioning first arithmetic unit 
Rl by the second arithmetic unit R2 is according to the 
invention available more quickly than the resetting function 
of the activating unit AE based upon the first watchdog 
circuit WDSl from Figure 1 or 2 , the perfectly functioning 

20 second arithmetic unit R2 first resets the faulty first 

arithmetic unit Rl and only in a second step and indirectly 
via the third OR gate OR3 optionally also the activating unit 
AE. 

25 Only the two special cases in columns 7 and 8 remain to be 
explained: 

Column 7 shows the first special case of the decision matrix. 
Here, only the activating unit AE is operating to 
30 expectations. A resetting of the two arithmetic units Rl and 
R2 is therefore carried out on the basis of the two watchdog 
circuits WDSl and WDS2 via which the activating unit AE can 
detect the malfunctioning of the two arithmetic units Rl and 
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R2 and therefore outputs the reset signal sae to reset them. 

In column 8, neither of the arithmetic units Rl or R2 is 
functioning properly, nor the activating unit AE. This fault 
in the control unit constitutes a threefold fault and is 
therefore very improbable. In this event, the behavior of the 
circuit cannot be predicted. 



